Analysts skeptical iPhone X’s Face ID will be foolproof

The iPhone 8 (left) and 8 Plus after Apple’s product event at the new Steve Jobs Theater in Cupertino.

The iPhone 8 (left) and 8 Plus after Apple’s product event at the new Steve Jobs Theater in Cupertino.

Photo: JIM WILSON, NYT

Image 2 of 4

The new iPhones models are, from left, X, 8 and 8 Plus.

The new iPhones models are, from left, X, 8 and 8 Plus.

Photo: JIM WILSON, NYT

Image 3 of 4

An AirPower mat is seen charging multiple devices during the Apple media event Tuesday.

An AirPower mat is seen charging multiple devices during the Apple media event Tuesday.

Photo: JOSH EDELSON, AFP/Getty Images

Image 4 of 4

The new Apple Watch Series 3 is displayed.

The new Apple Watch Series 3 is displayed.

Photo: Marcio Jose Sanchez, Associated Press

Analysts skeptical iPhone X’s Face ID will be foolproof

1 / 4

Back to Gallery

Apple is placing a bold bet that your face can securely unlock your phone, but experts are skeptical that it will be foolproof from the get-go.

The iPhone X, out in November, will rely on facial recognition technology called Face ID. Apple, which is known for discarding technologies more aggressively than rivals, dumped its well-tested Touch ID fingerprint system that has been available in iPhones since 2013.

While Face ID appears to be more sophisticated than the biometric systems used in competing devices like Samsung’s Galaxy S8 phones, experts say the iPhone X will have to prove it won’t be fooled by facial hair, makeup, glasses, masks, skin tones or poor lighting.

Apple’s bet goes beyond just unlocking phones. On Tuesday, Apple executive Phil Schiller said Face ID could also be used for purchases on an iPhone.

There are enough unanswered questions to make Premkumar Natarajan, a biometrics industry expert and Apple stockholder, decide to wait until long after the iPhone X goes on sale in November.

More on Apple

“How it’s going to work out is not clear to me,” said Natarajan, vice dean and professor of computer science at the USC Viterbi School of Engineering. “I was really looking forward to buying this, but now, I’m going to wait six to eight months to see what the reports are.”

Once a user’s face is detected, a dot projector in the $999 iPhone X places 30,000 infrared dots on it, and an infrared camera takes a photo. Then, a computer system uses that information to create a mathematical model of the user’s face. If that model matches one created when the user first set up the iPhone, the screen unlocks. If Face ID doesn’t recognize the owner, the phone will ask for a pass code, which like Touch ID, will still be required when the phone restarts.

Touch ID remains a part of the new iPhone 8 and iPhone 8 Plus. But the iPhone X’s larger screen required removing the physical home button, which doubled as the fingerprint reader for Touch ID.

Apple claims Face ID has a 1 in a million chance of letting the wrong person into the phone, compared to Touch ID, which has a 1 in 50,000 chance. The company said if a user changes hairstyles, wears a hat or puts on glasses, the iPhone X will still recognize them. The company said it tested the technology on thousands of people, taking a billion images. Tests were done with Hollywood mask makers to ensure that the technology wouldn’t falter, Schiller said.

“The team has worked hard to protect your face data,” Schiller said. Face data won’t be uploaded to Apple’s servers, staying on the phone instead.

Still, hackers have managed to circumvent Samsung’s Galaxy S8 iris scan lock feature by using a digital photo and a contact lens. Marc Rogers, head of information security for Internet security firm Cloudflare, said he doesn’t think Face ID will be fooled by an ordinary photo.

A demo of how the animoji feature works on an iPhone X. IPhone X users can send messages with animated animals that mimic their facial expressions.

Media: Wlee@sfchronicle.com / sfchronicle.com

“However, the jury is out as to how secure it is,” Rogers said in an email. “Knowing Apple, it will be good, but the big question is will it be good enough.”

And he said asking consumers to trust Face ID may take a while. “Touch ID was great because it required you doing something you normally do, touch the home button,” he said. “Taking a selfie to pay for something doesn’t feel natural to me. When people find things awkward, they don’t use them. That’s why before Touch ID, less than 1 in 5 people even had a PIN on their phone.”

Whether consumers adopt Face ID depends on finding more uses, said Ramon Llamas, a research manager at IDC.

“Outside of acting as a password, what else are they going to bring to the table?” Llamas said.

Apple said that app makers including Mint and E-Trade and 1Password were planning to implement Face ID.

Michael Fey, the lead iOS developer for AgileBits, which makes the 1Password app, said he believes Face ID is a “natural progression” from using fingerprint identification.

Fey said implementing Face ID “under the hood” was similar to adding Touch ID to 1Password.

The new technology also raises a legal question. Could a police officer order an iPhone X user to unlock a smartphone by simply looking at it? Some courts have ruled that a pass code is protected under the Fifth Amendment because it could lead to self-incrimination, but a fingerprint is not, even though it can be used to unlock a phone, said Clare Garvie, an associate with the Center on Privacy and Technology at Georgetown Law.

“Whether that’s the correct distinction to draw, I think is an open question,” Garvie said.

There is also the possibility that people with darker skin tones may have a harder time getting the computer systems to recognize their images, if the system was not tested on enough people of those hues. Some analysts believe that is what led to Google Photos and Yahoo’s photo storage service Flickr labeling photos of black people as gorillas or apes.

Natarajan said darker skin colors do affect facial recognition technology and wondered what Apple has done “to make sure the performance is uniform across different demographic segments.”

Apple did not immediately respond to questions about this aspect of Face ID or others.

Biometric technology expert Anil Jain believes iPhone X owners will eventually adopt Face ID if Apple has designed it to be as consumer friendly as Touch ID.

“We’ll have to wait and see after people start using it,” said Jain, a Michigan State University computer science and engineering professor.

Jain also questioned why Apple didn’t keep Touch ID as an option.

“It is easy to integrate face, fingerprint and iris,” Jain said. “Why not put all three, then let the user decide which one they want to use at any given point?”

Rogers said he wanted to get his hands on an iPhone X to try to hack Face ID. But he said other buyers should use caution.

“Use it to lock and unlock the phone, but maybe not your life’s secrets or bank accounts until there’s confidence,” he said.